Baystate Family Dental

OCR opened an investigation of the covered entity (CE), Baystate Family Dental, after it filed a breach report stating that a former employee impermissibly accessed protected health information (PHI), potentially affecting all 4,800 patients at the facility. The types of PHI involved in the breach included patients' names, dates of birth, dates of service, claims information, payment information, diagnoses/conditions, lab results, and medications. The CE provided breach notification to HHS, affected individuals, and the media, and offered all affected individuals one free year of identity protection services. Following the breach, the CE immediately filed a police report and conducted an audit of all the paper charts and identified 19 missing charts. The CE hired an IT consultant who installed a new computer server with a new firewall. The CE upgraded physical security, retrained staff, and ensured that all passwords were disabled and changed. As a result of OCR’s investigation, the CE completed a risk analysis and risk management plan and implemented new security policies and procedures to ensure adequate safeguards for PHI.